CoBrowse test

1. Prepare a run

1. Open Page A in iPhone Safari with Prevent Cross-Site Tracking enabled. Keep privacy protections enabled.
2. Record the environment below. Safari privacy settings cannot be reliably detected by this page.
3. On A, initialize the diagnostic marker and cookies once. Note the eight-character diagnostic run code. It is unrelated to ScreenMeet.
4. Join a new live session with the supported ScreenMeet button below.
5. Export A, navigate to B in this same tab, enter the diagnostic run code, observe and export B. Change the dummy input and counter while the agent watches. Return to A, observe and export again.
6. Record what the original agent sees. Repeat with a fresh session in desktop Chrome as a control.

This code selects only harmless diagnostic cookie names. It never joins a session. Enter the same code manually on B; no URL or shared-storage handoff is used.

2. Join and navigate

UNTESTED — waiting for bootstrap.

The counter and input are ordinary DOM controls. Updating them locally is not proof that an agent sees them.

3. Confirm in the original agent view

Choose PASS/FAIL only after checking the actual original agent view. Local start events are not a continuity verdict.

Timestamped observations

PASS / FAIL apply only to the stated measurement. OBSERVED records a fact without a causal conclusion. UNTESTED means evidence is missing.

Export separately on A, B, and A-return. Keep the three files together using the diagnostic run code. Nothing is uploaded or automatically imported across origins.

Interpretation and limits

• Storage: B has a different origin. Missing A storage on B does not prove deletion on A. A return check concerns only our separate diagnostic marker. ScreenMeet keys may change during the SDK lifecycle; values are never copied, restored, or exported.
• Cookies: A attempts Domain=brien.tech and Domain=qa.brien.tech with Path=/; Secure; SameSite=Lax; Max-Age=1200 (20 minutes). The root cookie is expected on both hosts. A is outside qa.brien.tech, so its narrower-domain cookie is expected to be rejected. B’s ability to set that cookie is not tested. No cookies are recreated on navigation.
• Visibility: document.cookie does not reveal Domain attributes or HttpOnly cookies. The server endpoint reports only the two diagnostic cookie names for the entered run and never sets replacement cookies. Immediate availability says nothing about long-term ITP expiry.
• window.name: only empty/nonempty, length, and cb-/other classification are shown. Observations are before bootstrap, at registration execution, at documented start/stop events, and on manual snapshots. Event timing is not proof of the exact internal SDK write.
• Integration: script load, registration call, iframe presence/load, and local session events do not establish agent-view continuity. Event details and actual session identifiers are ignored.
• Instrumentation: lightweight snapshots and a bounded same-origin diagnostic journal add some execution and DOM overhead. No SDK timing changes, navigation interception, custom SID bridge, window.name writes, automatic joining, or ScreenMeet storage copying are used. SDK-owned network traffic and vendor logs are outside this instrumentation’s control.
• Run codes are manual; a wrong code, expired cookies, a different tab, or cleared storage can invalidate comparisons. Use a fresh tab on A for each run. Record manual metadata again on B. No iOS or live-session result is implied by desktop prerequisites.

Official references: Cross-domain setup · Bootstrap and CSP · Session events · Supported controls